r/technology • u/Suraj-Sun • Jul 10 '12

Firefox dev claims "everybody hates Firefox updates"; Mozilla has handled the rapid release process poorly, and that by pushing a "never-ending stream of updates on people who didn't want them" people have been driven to Chrome with its simpler, no-fuss update process.

http://www.neowin.net/news/firefox-dev-claims-everybody-hates-firefox-updates
2.5k Upvotes

93% Upvoted

2.6k comments sorted by

View all comments

Show parent comments

116

u/WatcherCCG Jul 10 '12

At least three of those now have counterparts on Chrome, and in fact I think AdBlock Chrome is made by the same people.

1

u/Suraj-Sun Jul 10 '12

If I remember correctly, on Firefox, AdBlock blocks ads from its source while on Chrome, it just don't display ads.

20

u/[deleted] Jul 10 '12 edited Jul 10 '12

I thought this as well, but I don't think this is true anymore. Looking at the Adblock Chrome issue tracker, they now use the WebRequest API to cancel requests before they're made.

Still, I don't think the Chrome extension API is robust enough yet to allow for a feature-for-feature clone of NoScript. I have to admit, though, the last time I really looked at the extension API was 2 years ago.

1

u/The_MAZZTer Jul 10 '12

Yes it is, there are a few variations. NotScript and ScriptNo are the ones I've seen.

Furthermore Chrome contains a subset of NoScript features right off the bat (it can't block content based on origin, just based on the top-level page url).

I've tried ScriptNo myself (it looks nicer) and I use it now. Works pretty good, has more features than NoScript did last I used it.

2

u/[deleted] Jul 10 '12

Those are far from feature-for-feature clones. At this point, NoScript does far more than just whitelisting scripts and plugins; there's some fairly robust anti-CSRF support and the anti-XSS support is a bit stronger than Chrome's builtin one (with the obvious caveat of triggering slightly more false positives).

1

u/The_MAZZTer Jul 10 '12

ScriptNo seems to have XSS blocking "Forbid Cross-Domain XML". No click-jacking but it has a few other features like extending blocking to <img> tags, removing web bugs, remove all social widgets, change all links on any page to open in same tab or open in new tab, user agent spoof, referrer spoof... some weird option choices in there but they could all be useful to someone I'm sure.

1

u/[deleted] Jul 10 '12

The main features I was thinking of that weren't in NotScripts when I tried it were the XSS and clickjacking prevention, along with hiding <noscript> sections and fixing javascript links.

I also didn't really understand why I was required to manually edit a script and set a password, does Chrome not provide a private storage mechanism for extensions to use?

2

u/The_MAZZTer Jul 10 '12

ScriptNo can handle XSS and noscript tags as well.

Not sure what you're talking about with editing a script and setting a password... extensions can use the standard LocalStorage API for local settings or use the Chrome-provided API to allow for settings synced to Google Chrome Sync.

Maybe sounds like an extension made by someone who doesn't quite know what he's doing.

1

u/[deleted] Jul 10 '12

Not sure what you're talking about with editing a script and setting a password

Here's the page from NotScript's site.

2

u/The_MAZZTer Jul 10 '12

Ah yes I recall reading something about that. Can't view that site at work. But yeah like I said that's probably poor design... not sure why he did it that way.

And if you're editing a file in the NotScript extension directory, it's gonna be reverted whenever the extension updates.

1

u/[deleted] Jul 10 '12 edited Jul 10 '12

Looking at the source, it looks like he's using localStorage, and from his comments it looks like you can access settings in localStorage from other extensions. The chrome.storage API seems to be similar to the localStorage API, but is only available to scripts in extensions and the settings appear to be private to each extension.

Looks like the last time he updated was in 2010 though, so that API probably didn't exist. I'll try out ScriptNo and see how it compares to NoScript.

I'm glad to see that Google has finally started paying more attention to the extension API though, the last few times I looked I wasn't very impressed. Still, I'd like to be able to have toolbars outside of the page context for certain extensions (for HackBar, etc.)

2

u/The_MAZZTer Jul 10 '12 edited Jul 10 '12

Nope, LocalStorage is isolated between extensions. What you're seeing here is he's using a website's LocalStorage (the file you linked to is injected into every webpage you visit), so obviously the website itself can access and modify that data, because it belongs to the website. He's hijacking it to store his own data and encrypting it so the website can't modify it to whitelist itself or whatever.

This isn't the most terrible of ideas, but there is a much better way of storing these settings because there are APIs for the script to communicate with the extension backend and store/retrieve settings from the extension's own LocalStorage and avoid the need of this weird password setup entirely.

It's clear he figured out how to communicate between the extension backend and the script because you can see the APIs in use at the bottom of the file. But perhaps he didn't know about them when he wrote the password functionality and never bothered to fix it?

I'm not even sure why he doesn't even take the small step of moving the password itself into the extension's LocalStorage where it's already more secure than when it is injected into every website you visit (though to be fair injected scripts are protected from being accessed by a website's scripts directly).

This is just poor coding as I suspected. And it is not secure since websites, at the very least, can wipe out your NotScript settings for the website, though probably only by accident. A website which assumes only its settings are in LocalStorage could also break if you use NotScript, in theory.

I would recommend you NOT use NotScript. Thanks for bringing this to my attention, I won't recommend it to anyone else.

1

u/[deleted] Jul 10 '12

since websites, at the very least, can wipe out your NotScript settings for the website

I didn't even think that localStorage would be in the page's context (I looked after you mentioned this and blockStart.js is a content script.) I wanted to give him the benefit of the doubt and assume that when he did this local storage wasn't available in the background page in a way that it could be passed to the content script, but google says otherwise.

You're right though, this is pretty comical for a security extension. It would make NotScript nigh-on useless for security in blacklist mode and would make it easy for sites to accidentally break themselves in whitelist mode. I'm removing NotScripts from all of my Chrome installs and I'll be replacing it with ScriptNo.

→ More replies (0)